bugGNU GRUB - Bugs: bug #37020, grub password protection behaviour...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37020: grub password protection behaviour changed? BUG OR FEATURE?

Submitter:  mate biro <arch_scar>
Submitted:  Fri 03 Aug 2012 04:42:04 AM UTC
   
 
Category:  Configuration Severity:  Major
Priority:  5 - Normal Item Group:  None
Status:  Invalid Privacy:  Public
Assigned to:  None Originator Name:  Mate Biro
Open/Closed:  Closed Release:  other
Release:  Reproducibility:  Every Time
Planned Release:  None

Fri 10 Aug 2012 08:07:58 PM UTC, comment #3: 

The decision to change behaviour was not taken lightly but has a good security reason: entries generated by some additional script should be restricted unless further action taken (secure by default).

Vladimir Serbinenko <phcoder>
Group administrator
Mon 06 Aug 2012 06:56:50 AM UTC, comment #2: 

First of all, thank you.

As you see, I use a rolling-release distro, so I was courious if there was a config file to edit, to put the "--unrestricted" option to my menuentries automatically, as I regenerate my grub.conf file. ( That happens often. ) But nobody explained it.

I will try to figure it out myself.

And I've read the manual. But as the BEHAVIOUR has changed, I did not understood fully, what happened there. ( I'm not the only one, just look around on the web. )

And one last thing. Forums are there to help and to guide.
So, it is RTM, not RTFM. This is what discourages people to ask.

Thank you.

mate biro <arch_scar>
Sat 04 Aug 2012 12:08:21 PM UTC, comment #1: 

RTFM.
menuentry --unrestricted "Boot it" {
....
}

Vladimir Serbinenko <phcoder>
Group administrator
Fri 03 Aug 2012 04:42:04 AM UTC, original submission:  

Software version is: grub-common-2.0.0-1
                     grub-bios-2.0.0-1

Find the original bug post at the arch linux forums.

( https://bbs.archlinux.org/viewtopic.php?id=144572 )

I've newly installed arch on a laptop, and ( paranoid as always  ) I wanted to password-protect the menu editing in grub2, as described in the wiki. It always worked until now, but now the entries became password-protected even against booting. (That actually works, when I type in user/password)

What I did was :

generate a hashed pass with

# grub-mkpasswd-pbkdf2

and I've put the following code at the end of /etc/grub.d/00_header:

--------------------------------

cat << EOF

set superusers="myname"
password_pbkdf2 myname grub.pbkdf2.sha512.10000.looooooooooooooongstring

EOF

-------------------------------

I've seen that there was a package update of grub2-common and grub2-bios the 28 june, maybe something has changed upstream?

How can I now setup grub2 to be password-protected only against EDITING and not BOOTING?

[EDIT: I can regenerate the same behaviour on a system running in Virtualbox too.]

mate biro <arch_scar>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by arch_scar (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-08-04 phcoder StatusNone Invalid
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code